CVE-2026-54272
MediumAdvisory
Published 3 Aug 2026In the index since 5 Sept 2026
- Severity
- Medium
- worst across findings
- CVSS
- 6.9
- base score, highest
- EPSS
- 0.004
- 28th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 128
- of 17,781 indexed, latest versions
- Container images
- 116
- deployed by those charts
- Fix available
- 1 of 1
- affected package
ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses can bypass SSRF and trust-boundary checks
Carried by container images the latest versions of 128 of 17,781 indexed charts deploy, on 116 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| ip-addressnpm | 10.1.1, 10.2.0 | 10.2.1 | 116 |
- OSV records
- GHSA-22jq-vg5j-6vgg
Charts affected
128 by stars
Container images carrying it
116 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| louislam/ | 91e963bfda56 | ip-address | 10.2.1 | 1 |
| luligu/ | 1ec50ecd0694 | ip-address | 10.2.1 | 1 |
| mautic/ | eb8cc73d97e1 | ip-address | 10.2.1 | 1 |
| n8nio/ | 761374d4eb84 | ip-address | 10.2.1 | 1 |
| n8nio/ | cfe2704ff858 | ip-address | 10.2.1 | 1 |
| nodered/ | 10f40d0a83e7 | ip-address | 10.2.1 | 1 |
| nodered/ | a649dd711d55 | ip-address | 10.2.1 | 1 |
| nodered/ | d73ae167cb9b | ip-address | 10.2.1 | 1 |
| nousresearch/ | e0df6adebddf | ip-address | 10.2.1 | 1 |
| oneuptime/ | 6da7de4fc0f3 | ip-address | 10.2.1 | 1 |
| oneuptime/ | 6b2d98713711 | ip-address | 10.2.1 | 1 |
| oneuptime/ | 4accc516d800 | ip-address | 10.2.1 | 1 |
| otwld/ | d1954b759e47 | ip-address | 10.2.1 | 1 |
| outlinewiki/ | 832051f039b4 | ip-address | 10.2.1 | 1 |
| penpotapp/ | 72a8061e8806 | ip-address | 10.2.1 | 1 |
| penpotapp/ | 84f3f07ead11 | ip-address | 10.2.1 | 1 |
| rocketchat/ | 44af8ac4e711 | ip-address | 10.2.1 | 1 |
| rocketchat/ | 6bc18fb5d0e5 | ip-address | 10.2.1 | 1 |
| rocketchat/ | 819771c4abe4 | ip-address | 10.2.1 | 1 |
| rocketchat/ | c1170bdfe797 | ip-address | 10.2.1 | 1 |
| saidsef/ | 67025e3a163e | ip-address | 10.2.1 | 1 |
| shieldsio/ | fa194b446e42 | ip-address | 10.2.1 | 1 |
| supabase/ | c8eb9858eafe | ip-address | 10.2.1 | 1 |
| supabase/ | f6c42a04163d | ip-address | 10.2.1 | 1 |
| tenureai/ | 5f5b222df9a5 | ip-address | 10.2.1 | 1 |
| trackerforce/ | 28ee0c4e0b88 | ip-address | 10.2.1 | 1 |
| trackerforce/ | 67e2c261f7b4 | ip-address | 10.2.1 | 1 |
| treskon/ | e7970783bc8d | ip-address | 10.2.1 | 1 |
| twentycrm/ | e7d9948bf284 | ip-address | 10.2.1 | 1 |
| veecode/ | c443520aebf7 | ip-address | 10.2.1 | 1 |
| wsjbr/ | 5e594f5f09f6 | ip-address | 10.2.1 | 1 |
| xxczaki/ | bb919aac45dc | ip-address | 10.2.1 | 1 |
| ghcr.io/ | 19553e4b4033 | ip-address | 10.2.1 | 1 |
| ghcr.io/ | c487ec5edcfe | ip-address | 10.2.1 | 1 |
| ghcr.io/ | 792e262ea504 | ip-address | 10.2.1 | 1 |
| ghcr.io/ | d95725b24dbe | ip-address | 10.2.1 | 1 |
| ghcr.io/ | 2ed0183564d7 | ip-address | 10.2.1 | 1 |
| ghcr.io/ | 8726533b9e69 | ip-address | 10.2.1 | 1 |
| ghcr.io/ | 8b621866ceb2 | ip-address | 10.2.1 | 1 |
| ghcr.io/ | 87f9e8a92bd7 | ip-address | 10.2.1 | 1 |
| ghcr.io/ | 84edfe8a67a8 | ip-address | 10.2.1 | 1 |
| ghcr.io/ | 046dfdb8550c | ip-address | 10.2.1 | 1 |
| ghcr.io/ | 236faedcb68a | ip-address | 10.2.1 | 1 |
| ghcr.io/ | 05e16dd56cfb | ip-address | 10.2.1 | 1 |
| ghcr.io/ | 1f5b892aeef4 | ip-address | 10.2.1 | 1 |
| ghcr.io/ | f23ad77a681b | ip-address | 10.2.1 | 1 |
| ghcr.io/ | ae13784ffcfc | ip-address | 10.2.1 | 1 |
| ghcr.io/ | eb4f736b8cd4 | ip-address | 10.2.1 | 1 |
| ghcr.io/ | b069e4307dec | ip-address | 10.2.1 | 1 |
| ghcr.io/ | 65463e02f887 | ip-address | 10.2.1 | 1 |